agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI…
Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural overview. Triggers: trailmark summary, code summary, structural overview.
$ npx -y skills add trailofbits/skills --skill trailmark-summary --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/trailmark-summaryContext preview
The summary Claude sees to decide when to auto-load this skill.
Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural overview. Triggers: trailmark summary, code summary, structural overview.
name: trailmark-summary description: "Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural overview. Triggers: trailmark summary, code summary, structural overview." allowed-tools: Bash Read Grep Glob
Runs `trailmark analyze --language auto --summary` on a target directory. This is a v0.2-safe workflow; do not require Trailmark 0.4.0 just to produce a summary.
| Rationalization | Why It's Wrong | Required Action | |-----------------|----------------|-----------------| | "I can read the code manually instead" | Manual reading misses parser-based language detection, dependency data, and entry point enumeration | Install and run trailmark | | "Language detection doesn't matter" | Wrong language selection produces empty or partial analysis | Use Trailmark's parser-based detection or `--language auto` | | "Partial output is good enough" | Missing any of the three required outputs (detected languages, entry points, dependencies) means incomplete analysis | Verify all three are present | | "Tool isn't installed, I'll skip it" | This skill exists specifically to run trailmark | Report the installation gap instead of skipping |
The target directory is passed via the `args` parameter.
**Step 1: Check that trailmark is available.**
trailmark analyze --help 2>/dev/null || \ uv run trailmark analyze --help 2>/dev/null
If neither command works, report "trailmark is not installed" and return. Do NOT run `pip install`, `uv pip install`, `git clone`, or any install command. The user must install trailmark themselves.
Optionally record the version if the installed build supports it:
trailmark --version 2>/dev/null || uv run trailmark --version 2>/dev/null || true
Do not fail if the version command is missing; older v0.2.x builds may still support the summary workflow.
**Step 2: Detect languages with Trailmark's parse API.**
python3 - "{args}" <<'PY'
import json
import sys
try:
from trailmark.parse import detect_languages # canonical location since 0.3.x
except ModuleNotFoundError:
# v0.2.x predates trailmark.parse; the same function lives in query.api
from trailmark.query.api import detect_languages
print(json.dumps(detect_languages(sys.argv[1])))
PYIf the import fails, rerun the same snippet with `uv run --with trailmark python - "{args}"`. If the result is `[]`, report "Trailmark found no supported languages under target" and return.
**Step 3: Run the summary with auto-detection.**
trailmark analyze --language auto --summary {args} 2>&1 || \
uv run trailmark analyze --language auto --summary {args} 2>&1**Step 4: Verify the output.**
The output must include ALL THREE of: 1. Detected languages from Step 2 2. `Entrypoints:` line from the summary output 3. `Dependencies:` line from the summary output
If any are missing, report the gap. Do not fabricate output.
Return the detected language list plus the full Trailmark summary output. If a version string was available, include it in the returned metadata.
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems,…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls,…